Security Headers Checker — Test HSTS, CSP & More, Get an A-F Grade
Check any website's HTTP security headers instantly. Get a grade (A+ to F), see missing headers like HSTS, CSP, X-Frame-Options and get fix recommendations.
Frequently Asked Questions
What HTTP security headers are checked?
The tool checks 7 headers: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and X-XSS-Protection — covering the most critical browser-level security controls.
What does the security grade mean?
Grades range from A+ (all critical headers present) to F (most headers missing). A or A+ means strong security configuration. B is acceptable. C or below means critical headers are absent and urgent fixes are needed.
How do I add security headers to my website?
For Apache, add Header directives to .htaccess or your VirtualHost config. For Nginx, use add_header directives in your server block. For Node.js/Express, use the helmet middleware. For CDN-hosted sites, set custom response headers in Cloudflare, Vercel, or Netlify settings.
Does the tool store the URLs I check?
No. The URL is fetched in real time to retrieve HTTP headers only — no page content is accessed or stored. The check is processed and discarded immediately. We do not log URLs or results.
